MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SnakeKeylogger


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e
SHA3-384 hash: d2881b177f3ff06fc71b58dd382d7631f70a05065043566614f017a5916072d6e1da69e8c66b41b0ca370217634fffe2
SHA1 hash: 4799db2196420cc90b24e28519ed459119d71fca
MD5 hash: c01e2956b20349d01fd6f43f9a7ef0c3
humanhash: autumn-massachusetts-texas-oven
File name:BEIJING XIANTE TECHNOLOGY-Materials (MD) RFQ21-1005R1.pdf.exe
Download: download sample
Signature SnakeKeylogger
Create hunting rule
File size:574'464 bytes
First seen:2022-07-05 12:01:07 UTC
Last seen:2022-07-06 06:34:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:X3ZGUUTBePSVM+qphxMqP6HyjCiPYra6qzS0zRVvM0z14s8:X3ZjUTBZZohxMrSOiy0Db14s
TLSH T189C41220E7BA0B21C47C87F9555092280BFA638A3930EB1D9EC174D65535F81877ABBB
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 70f0c4d2d2c4f070 (11 x AgentTesla, 7 x Formbook, 5 x Loki)
Reporter abuse_ch
Tags:exe SnakeKeylogger

Intelligence

File Origin
# of uploads :
12
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Kryptic.18.27030.30835.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62c4287976fa5a59944475d8/reports/3ed7045e-6d25-40f5-b2d1-b73ec85b4815/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e3496cda-7b7d-448b-89ca-f429ecdbd944
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1024781
Signature
.NET source code references suspicious native API functions
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-07-05 08:29:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6r4vi2z3hgic53kjztososn54dlp7mtagepyvasa7juxadrkeaha._file
Verdict:
malicious
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger stealer
Link:
https://tria.ge/reports/220705-n7fefsghel/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Snake Keylogger
Snake Keylogger Payload
Unpacked files
SH256 hash:
971508e3168782e769d70446821248f8ee3be74264e76f38ef129f0366a10980
MD5 hash:
086462a9245c0e22b9e68896687344f1
SHA1 hash:
f9ee9f528e378f529e39560b90e3ffd8ffd48de6
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
SH256 hash:
6e1e63e9dd4fec99c80782f2962e1449b297275796633c3c11efffa517c00196
MD5 hash:
27a1b077de261ec49d1536914b07c3bf
SHA1 hash:
b43846001b164183301aeb05348d859da6aed60b
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
SH256 hash:
70bb4f8aa7d0a33f8206f78c845fa2bd686c2a0f2b3bd50cd0b6b887a45398ca
MD5 hash:
30d61a3a3e26c2bca2eb766990132d7c
SHA1 hash:
94f9742d5f21b13f7d8d194fe938193cbb6a0d4d
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
SH256 hash:
3b59fe180dd50e3f3d4fdcbdd4e7a2d4e3e1c85ae43cb4f3716c4be41e9ec2ae
MD5 hash:
9ea556e333e216a65aa09c102f36004f
SHA1 hash:
814c07f1dc68bd61840384aac3aa8346d9f8148f
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
SH256 hash:
bd9ac53af0aed4b7ed697d424561305aa2f31d2e587b3cfb28831f3debc733b0
MD5 hash:
63035b7cdcf3b0ad5fff695bc9b6a13e
SHA1 hash:
085345ce4ea99ca37ed36c952ab52a2d93f73a84
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
SH256 hash:
f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e
MD5 hash:
c01e2956b20349d01fd6f43f9a7ef0c3
SHA1 hash:
4799db2196420cc90b24e28519ed459119d71fca
Link:
https://www.unpac.me/results/9307b7c2-e597-4ceb-9b97-28f9da0b5676/
Malware family:
SnakeKeylogger
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f479546b3b39/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SnakeKeylogger

rar 62d027e4200988773e4a37cffc36254c125751fe64714a956fbdfaa4dc212f43

SnakeKeylogger

Executable exe f479546b3b39902eed49ccdd2749bde0d6ffb260311f8a8240fa69700e2a200e

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
URLhaus
https://urlhaus.abuse.ch/url/2254159/
  
Dropped by
SHA256 62d027e4200988773e4a37cffc36254c125751fe64714a956fbdfaa4dc212f43
  
Dropped by
MD5 08307d5f55cc9efa130d41cf2485ec61

Comments